Add Sankofa consolidated hub operator tooling

config/nginx/sankofa-api-hub-main.example.conf

@@ -0,0 +1,19 @@
+# Top-level nginx.conf for API hub — copy to /etc/sankofa-phoenix-api-hub/nginx.conf on CT.
+# Include path-based site from sankofa-phoenix-api-hub.example.conf under conf.d/
+
+user  nginx;
+worker_processes auto;
+error_log  /var/log/nginx/error.log warn;
+pid        /var/run/nginx.pid;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+    sendfile        on;
+    keepalive_timeout  65;
+    include /etc/sankofa-phoenix-api-hub/conf.d/*.conf;
+}

config/nginx/sankofa-hub-main.example.conf

@@ -0,0 +1,23 @@
+# Top-level nginx.conf for systemd ExecStart -c /etc/sankofa-web-hub/nginx.conf
+# On CT: install snippets to /etc/sankofa-web-hub/ and include site conf from repo examples.
+#
+#   mkdir -p /etc/sankofa-web-hub/conf.d
+#   cp repo/config/nginx/sankofa-non-chain-frontends.example.conf /etc/sankofa-web-hub/conf.d/site.conf
+#   cp repo/config/nginx/sankofa-hub-main.example.conf /etc/sankofa-web-hub/nginx.conf
+
+user  nginx;
+worker_processes auto;
+error_log  /var/log/nginx/error.log warn;
+pid        /var/run/nginx.pid;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+    sendfile        on;
+    keepalive_timeout  65;
+    include /etc/sankofa-web-hub/conf.d/*.conf;
+}

config/nginx/sankofa-non-chain-frontends.example.conf

@@ -0,0 +1,27 @@
+# Example: single nginx "web hub" for multiple non-chain hostnames (static roots).
+# Copy to an LXC as e.g. /etc/nginx/sites-enabled/sankofa-web-hub.conf and adjust paths.
+# TLS: typically terminate at NPM; LAN can stay HTTP to this host.
+
+map $host $sankofa_site_root {
+    portal.sankofa.nexus  /var/www/portal;
+    admin.sankofa.nexus   /var/www/admin;
+    sankofa.nexus         /var/www/corporate;
+    www.sankofa.nexus     /var/www/corporate;
+    # clients.example.nexus /var/www/clients/example;
+    default               /var/www/default;
+}
+
+server {
+    listen 80;
+    server_name portal.sankofa.nexus admin.sankofa.nexus sankofa.nexus www.sankofa.nexus;
+
+    root $sankofa_site_root;
+    index index.html;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    add_header X-Content-Type-Options nosniff;
+    add_header Referrer-Policy strict-origin-when-cross-origin;
+}

config/nginx/sankofa-phoenix-api-hub.example.conf

@@ -0,0 +1,65 @@
+# Tier-1 API hub: one nginx listener; path-based routes to internal Phoenix + dbis_core.
+# Upstreams = loopback on same LXC after you colocate processes, or LAN IPs during migration.
+#
+# Adjust upstream addresses/ports to match ALL_VMIDS_ENDPOINTS / your compose layout.
+
+upstream sankofa_phoenix_graphql {
+    server 127.0.0.1:4000;
+    keepalive 32;
+}
+
+upstream dbis_core_rest {
+    server 127.0.0.1:3000;
+    keepalive 32;
+}
+
+server {
+    listen 8080;
+    server_name _;
+
+    # Optional: restrict to NPM / LAN source IPs
+    # allow 192.168.11.0/24;
+    # deny all;
+
+    location = /health {
+        default_type application/json;
+        return 200 '{"status":"hub-up"}';
+    }
+
+    location /graphql {
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 300s;
+        proxy_pass http://sankofa_phoenix_graphql;
+    }
+
+    location /graphql-ws {
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Accept-Encoding "";
+        proxy_buffering off;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 3600s;
+        proxy_pass http://sankofa_phoenix_graphql;
+    }
+
+    location /api/ {
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_pass http://dbis_core_rest;
+    }
+
+    location /api-docs {
+        proxy_pass http://dbis_core_rest;
+    }
+}